| // Copyright 2015 The Vanadium Authors. All rights reserved. |
| // Use of this source code is governed by a BSD-style |
| // license that can be found in the LICENSE file. |
| |
| // Measured methods for syncgroup management. |
| |
| package measure |
| |
| import ( |
| "fmt" |
| |
| "v.io/v23" |
| "v.io/v23/context" |
| "v.io/v23/security/access" |
| wire "v.io/v23/services/syncbase" |
| "v.io/v23/syncbase" |
| "v.io/x/sensorlog/internal/config" |
| "v.io/x/sensorlog/internal/sbmodel" |
| "v.io/x/sensorlog/internal/sbmodel/keyutil" |
| "v.io/x/sensorlog/internal/sbutil" |
| ) |
| |
| // InitSyncgroup creates the syncgroup for the measuring device devId, giving |
| // full configuration access to admin. The syncgroup uses sgPublishSb and |
| // sgMountTables for publishing (create/join) and syncing, respectively. |
| // InitSyncgroup must not be called concurrently for the same devId, or |
| // retried with different parameters for the same devId, otherwise behaviour |
| // is unspecified. |
| // TODO(ivanpi): Remove Resolve permissions when v.io/i/1110 is fixed. |
| func InitSyncgroup(ctx *context.T, db syncbase.Database, devId, admin, sgPublishSb string, sgMountTables []string) error { |
| if err := keyutil.ValidateId(devId); err != nil { |
| return fmt.Errorf("invalid devId: %v", err) |
| } |
| |
| sgId := wire.Id{Name: config.SyncgroupName(devId), Blessing: "blessing"} |
| // Check for syncgroup. If it already exists, we have nothing to do. |
| if sgs, err := db.ListSyncgroups(ctx); err != nil { |
| return err |
| } else { |
| for _, sg := range sgs { |
| if sg == sgId { |
| return nil |
| } |
| } |
| } |
| |
| // Both measured and admin client have full permissions on the syncgroup. |
| sgAcl := access.Permissions{} |
| sbutil.AddPermsForPrincipal(&sgAcl, v23.GetPrincipal(ctx), access.Read, access.Admin) |
| sbutil.AddPermsForPattern(&sgAcl, admin, access.Read, access.Admin) |
| |
| // Maps all syncgroup collections to ACLs. |
| collSpec := make(map[wire.Id]access.Permissions) |
| |
| // StreamDef : <devId> |
| // Note that since the SyncgroupSpec takes collections, we drop the devId. |
| // Admin client has full permissions, measured drops to readonly. |
| aclStreamDef := access.Permissions{} |
| sbutil.AddPermsForPrincipal(&aclStreamDef, v23.GetPrincipal(ctx), access.Resolve, access.Read) |
| sbutil.AddPermsForPattern(&aclStreamDef, admin, access.Resolve, access.Read, access.Write, access.Admin) |
| collSpec[sbmodel.CollectionId(&sbmodel.KStreamDef{})] = aclStreamDef |
| |
| // DataPoint : <devId> |
| // Note that since the SyncgroupSpec takes collections, we drop the devId. |
| // Admin client has full permissions, measured drops to read/write. |
| aclDataPoint := access.Permissions{} |
| sbutil.AddPermsForPrincipal(&aclDataPoint, v23.GetPrincipal(ctx), access.Resolve, access.Read, access.Write) |
| sbutil.AddPermsForPattern(&aclDataPoint, admin, access.Resolve, access.Read, access.Write, access.Admin) |
| collSpec[sbmodel.CollectionId(&sbmodel.KDataPoint{})] = aclDataPoint |
| |
| var collections []wire.Id |
| // Apply prefix ACLs to all syncgroup prefixes. |
| // TODO(ivanpi): Prefix ACLs have been removed, use collection ACLs. |
| for coll, _ := range collSpec { |
| collections = append(collections, coll) |
| } |
| |
| sgSpec := wire.SyncgroupSpec{ |
| Description: fmt.Sprintf("measured-main-%s", devId), |
| Perms: sgAcl, |
| Collections: collections, |
| MountTables: sgMountTables, |
| } |
| sgMemberInfo := wire.SyncgroupMemberInfo{SyncPriority: config.SyncPriority} |
| |
| return db.SyncgroupForId(sgId).Create(ctx, sgSpec, sgMemberInfo) |
| } |